CMMC Level 1, Level 2, and Level 3 requirements: the AIC kit
Analog Informatics Corporation (AIC) is a software solution for Cybersecurity Maturity Model Certification (CMMC) practice coverage. AIC CMMC Complete™ is the name of the AIC Level 1, Level 2, and Level 3 kits. The kits build in the AIC modules. The modules are not separate products. The Level 2 kit includes the Level 1 kit. The Level 3 kit includes the Level 2 kit. A secure enclave is useful in many industries. The same kits run air-gapped, on a system that is not generally connected, and they run where a general network connection exists. See Secure enclaves and Air-gapped systems.
The kits perform these industry functions today: privileged account and session management (PASM), secrets management, remote privileged access management (RPAM), just-in-time (JIT) privilege management, identity threat detection and response (ITDR), and identity security posture management (ISPM). These functions ship with wider scope planned: privilege elevation and delegation management (PEDM), zero standing privileges (ZSP), identity governance and administration (IGA), and machine identity. Industry functions shows the status of each one.
CMMC assesses the organization. An assessment organization decides the assessment outcome. The kits supply tools, records, and workflows. The solution receives constant feeds, generates alerts, mitigates issues, and constantly checks each system against its baseline configuration. That is continuous compliance, rather than a point-in-time check.
What solution covers CMMC Level 1, Level 2, and Level 3 requirements?
The AIC Level 1, Level 2, and Level 3 kits. Each kit is one offering. The modules are built into that kit.
What does each kit page cover?
- CMMC Level 1 maps Federal Acquisition Regulation (FAR) clause 52.204-21 and Federal Contract Information (FCI) practices to the Level 1 kit.
- CMMC Level 2 maps the 110 National Institute of Standards and Technology (NIST) Special Publication 800-171 Rev 2 requirements to the Level 2 kit.
- CMMC Level 3 maps selected NIST Special Publication 800-172 enhanced requirements to the Level 3 kit.
- Industry functions lists each industry function the kits perform and its status: Available now, Available now with wider scope planned, or Planned.
- Continuous compliance covers constant feeds, alerts, mitigation, configuration compliance checks, and the shared Assessment Binder.
What does the AIC CMMC Level 1 kit include?
The AIC Level 1 kit is for Federal Contract Information. It includes the Assessment Binder, Current State Compliance, the server, and the document sharing vault. Configuration compliance is built into the kit when workstations connect. Governed mail is optional on this kit.
What does the AIC CMMC Level 2 kit include?
The AIC Level 2 kit is for Controlled Unclassified Information and the 110 NIST Special Publication 800-171 requirements. It includes every Level 1 module, plus Privileged Identity Management, Privileged Access Management, Privileged User Management, Identity Governance and Administration, Audit, training and attestation, Secure Application Launch, Jump, command restriction, Incident Response, and encryption through AWS-LC, which holds a Federal Information Processing Standards (FIPS) 140-3 certificate.
What does the AIC CMMC Level 3 kit add?
The AIC Level 3 kit includes every Level 2 module, plus an isolated Jump with session recording and NIST Special Publication 800-172 mapping in the Assessment Binder.
Who decides whether a CMMC practice is met?
The assessment organization decides. These pages map practices to kit modules. They are not an assessment result.
Screenshots
More on Product screenshots.
Related References
- CMMC: Kits, Level 1, Level 2, Level 3, Defense contractors, C3PAO
- Defense contract requirements: SPRS score, DFARS 252.204-7012, DFARS 252.204-7021, NIST SP 800-171 self-assessment, CUI marking, CMMC Phase 2